FBI and European partners seize Virtualine bulletproof hosting domain tied to ransomware, StealC and CSAM forum hosting
Matéria consolidada. Reúne 7 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 31/10/2026 00:04; os links antigos trazem para cá.
Fontes: securityweek.com ↗ securityaffairs.com ↗ cyberscoop.com ↗ bleepingcomputer.com ↗ thehackernews.com ↗
The US Justice Department and the FBI (Washington Field Office, with the U.S. Attorney's Office for the Eastern District of Virginia) obtained a court order to seize the primary domain virtualine[.]net of Virtualine, a Russian-speaking bulletproof hosting (BPH) provider that also operated as Secury, Massgod, Spamhouse, Lanedo and Omegatech (thehackernews.com, cyberscoop.com, bleepingcomputer.com, securityaffairs.com, securityweek.com). The operation, announced on 28 October 2026, involved Polizei Hessen, Dutch police (including Politie Midden-Nederland, per securityaffairs.com), the UK National Crime Agency, OverRIPE and Lumen Technologies, with support from the DOJ Office of International Affairs (securityaffairs.com). Authorities say the service hosted a forum distributing CSAM and a hack-for-hire service after repeated notices, facilitated nonconsensual intimate images, and laundered criminal proceeds through Bitcoin. Court documents cited by securityweek.com state that Virtualine knowingly hosted illicit customer services, ignored abuse reports and helped customers evade law enforcement takedowns by migrating services to unaffiliated infrastructure. Dutch police seized dozens of physical servers in Limburg, which took hundreds of virtual servers offline (bleepingcomputer.com). The seizure is only partial: the government states that a new website Virtualine built with the criminal forum "Vendor 1" is still hosted by Virtualine and has already drawn at least one abuse complaint (securityaffairs.com). TRM Labs stresses the service was disrupted, not shut down, and the operators and underlying infrastructure may still be active (cyberscoop.com, securityweek.com). The operator denies knowingly hosting CSAM in an open letter on a new site, virtualine[.]org, captured by Silent Push (bleepingcomputer.com).
Detalhes técnicos
- Virtualine marketed itself on cybercrime forums, including HackForums, for phishing, spam, carding and port scanning. In September 2024 it told an Exploit.in user that it allowed phishing, payment card fraud, email spam and port scanning while banning CSAM and terrorism content, and in June 2025 it boasted on HackForums that it "ignored more abuse than your last three therapists" (securityaffairs.com). securityweek.com adds that it appeared on Exploit in 2024 claiming operations since 2019. In March 2026 it launched an "additional protection plan" that would move customers' criminal infrastructure to an unaffiliated shell company and reactivate the server when law enforcement requests arrived (thehackernews.com, securityaffairs.com).
- Virtualine claimed in 2025 to hold the largest collection of autonomous system numbers for malware and botnet hosting, and offered rapid migration of customer services to unaffiliated infrastructure to defeat takedowns (securityweek.com).
- Plans ranged from $19.99/month (1 vCPU, 2 GB RAM, 30 GB storage) to $179.99/month (24 vCPUs, 64 GB RAM), with optimized plans from $21.99 to $379.99/month (thehackernews.com).
- The DoJ says Virtualine hosted "Vendor 1", a criminal forum selling explicit images and videos of minors and adults and promoting a hack-for-hire service that breaks into victims' accounts to steal explicit content (securityaffairs.com). About a month after Virtualine assigned Vendor 1 an IP address, in January 2026, it began receiving reports from law enforcement in Germany, Canada and Australia, NCMEC and a victim's attorney, yet kept hosting the site despite multiple international takedown requests. It also allegedly helped build a new upload and purchase website, where users upload material and download it after payment, which is still hosted by Virtualine (thehackernews.com, cyberscoop.com, securityaffairs.com, securityweek.com).
- Virtualine accepted payments through unhosted Bitcoin addresses ("BTC [NO-AML]"), bypassing exchange compliance, and laundered the proceeds through further transactions to hide their source. Authorities say some payments came directly from criminal groups (securityaffairs.com). Chainalysis linked its addresses to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, scams and phishing platforms (thehackernews.com, bleepingcomputer.com).
- TRM Labs attributes direct payments as follows: Russian drug marketplace ~44%, sextortion scheme ~17%, cryptocurrency mixer ~13%, ransomware ~5%, cybercrime services 3% and malware 2%. Virtualine was not the largest bulletproof host by total inflows but received the most illicit-attributed value of any tracked BPH in 2026 to date, almost one-fifth of the total (cyberscoop.com, bleepingcomputer.com; the same TRM finding is reported by securityweek.com).
- Ransomware groups Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin paid the operators. So did customers tied to the StealC infostealer (TRM saw payments this year, indicating a constant financial relationship), the Matanbuchu loader, bot and malware-distribution services, and CSAM-linked sites (cyberscoop.com, bleepingcomputer.com).
- Dutch authorities say the platform facilitated ransomware, botnets, infostealers, phishing and child abuse material distribution since at least 2022 (bleepingcomputer.com).
- Spamhaus reported in September 2025 that Virtualine had expanded to AS209800, routed via aurologic GmbH, and kept obtaining IPv4 prefixes from poorly vetted Turkey- and U.S.-based IP brokers. Silent Push notes that a lost ASN does not mean the BPH has stopped, since new ASNs are acquired quickly (thehackernews.com).
- After the seizure the provider is partially online, but its network prefixes show very low routing visibility, suggesting much of the infrastructure is unreachable (bleepingcomputer.com).
Remediação
- Treat infrastructure associated with Virtualine and its aliases, including AS209800, as high-risk when assessing network blocking and monitoring (thehackernews.com). securityweek.com likewise advises treating historical Virtualine ASNs and IP ranges as high-risk.
- Monitor for customer infrastructure migrating to new hosting following the seizure (securityweek.com).
- A domain seizure disrupts how customers find and access the service but does not prove the operator has stopped or that customers lost access to the underlying infrastructure (TRM Labs, via cyberscoop.com and securityweek.com). The seizure does not end the activity, since the provider still hosts the new Vendor 1 site (securityaffairs.com).
- Defenders can use blockchain records of payments to Virtualine to trace customers and follow-on infrastructure (cyberscoop.com).
- Silent Push suggests that ASN and IP-broker registration controls are too lax and need tightening (thehackernews.com).
- securityaffairs.com gives no further defender-specific guidance.
Relatos divergentes
- Customer data and operator status: the operator says customer data is safe (thehackernews.com). The later bleepingcomputer.com report says Dutch police recovered data on more than 3,000 customers, with follow-up action underway, which contradicts that claim. The operator's statement is unverified.
- Extent of takedown: the headline framing of a seizure (thehackernews.com, bleepingcomputer.com, securityweek.com) suggests a major blow. Later reporting (cyberscoop.com, bleepingcomputer.com) says only the domain and part of the infrastructure were hit, and operators and remaining infrastructure may still be active. securityaffairs.com, citing the government, confirms the seizure is partial because the new Vendor 1 site remains hosted by Virtualine. These latter versions are more recent and cautious.
- Focus of the allegations: thehackernews.com and securityaffairs.com emphasize CSAM, nonconsensual intimate images and money laundering, while bleepingcomputer.com, cyberscoop.com and securityweek.com add ransomware, StealC and sextortion links, based mainly on TRM and Chainalysis blockchain analysis rather than on official charges.
- Start of operations: Virtualine claimed on Exploit to have operated since 2019 (securityweek.com), a self-reported claim, while Dutch authorities cite activity since at least 2022 (bleepingcomputer.com). The 2019 date is unverified.
Linha do tempo
-
FBI seizes virtualine.net, domain of Russian-speaking bulletproof hosting provider Virtualine
ler a análise desta fonte ocultar
The FBI has seized virtualine.net, the domain of a Russian-speaking bulletproof hosting provider also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech. Court documents state Virtualine knowingly hosted illicit customer services, ignored abuse reports and helped customers evade law enforcement takedowns by migrating services to unaffiliated infrastructure. The provider advertised support for phishing, spam and carding on forums such as Exploit, where it appeared in 2024 while claiming operations since 2019, and hosted child sexual abuse material as well as a hack-for-hire service targeting explicit content in online accounts. TRM Labs reports Virtualine received more illicit-attributed cryptocurrency than any other bulletproof hosting provider it tracks, with payments from a Russian drug marketplace (44%), a large sextortion scheme (17%), a crypto mixer (13%) and ransomware (5%), plus 2026 payments from StealC infostealer operators. TRM cautions that a domain seizure disrupts discovery and access but does not prove the operator has ceased activity or that the underlying infrastructure is gone.
Technical Details
- Virtualine claimed in 2025 to hold the largest collection of autonomous system numbers for malware and botnet hosting.
- It offered rapid migration of customer services to unaffiliated infrastructure to defeat takedowns.
- Despite multiple international takedown requests, it continued hosting a customer's illicit content site and helped build a replacement site still online.
Remediation
Defenders should treat historical Virtualine ASNs and IP ranges as high-risk and monitor for customer infrastructure migration following the seizure.
-
FBI seizes virtualine.net, bulletproof hosting provider tied to CSAM hosting and money laundering; new Vendor 1 site stays online
ler a análise desta fonte ocultar
The FBI Washington Field Office, with the U.S. Attorney's Office for the Eastern District of Virginia, seized the domain virtualine.net under court authorization. Virtualine (also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech) is a "bulletproof" hosting provider that advertised on cybercrime forums and ignored abuse complaints. The government says the service facilitated the advertisement of sexual images of minors, the disclosure of nonconsensual intimate images and international money laundering. The seizure is only partial: the government states that a new website Virtualine built with a criminal forum ("Vendor 1") is still hosted by Virtualine and has already drawn at least one abuse complaint.
Technical Details
- In September 2024, Virtualine told an Exploit.in user that it allowed phishing, payment card fraud, email spam and port scanning, while banning CSAM and terrorism content. In June 2025 it boasted on HackForums that it "ignored more abuse than your last three therapists."
- In March 2026 it advertised an "additional protection plan": after a law enforcement request, the customer's infrastructure would be moved to another unaffiliated shell company and the server reactivated.
- "Vendor 1" is a criminal forum selling access to explicit images and videos of minors and adults. It also promotes a hack-for-hire service that breaks into victims' accounts to steal explicit content.
- In January 2026, about a month after Virtualine assigned Vendor 1 an IP address, it began receiving CSAM reports from police in Germany, Canada and Australia, from NCMEC and from a victim's lawyer. It kept hosting the site and helped build a new one that lets users upload material and download it after payment.
- The new site accepted a "BTC [NO-AML]" option using bitcoin addresses outside a hosted payment service, avoiding illicit-funds checks. Authorities say some payments came directly from criminal groups, and Virtualine allegedly moved the funds through further transactions to hide their source.
- Partners in the investigation: Polizei Hessen, Politie Midden-Nederland, the UK National Crime Agency, and private partners OverRIPE and Lumen, with support from the DOJ Office of International Affairs.
Remediation
The article gives no defender-specific guidance. The seizure does not end the activity, since the provider still hosts the new Vendor 1 site.
-
US authorities seize primary domain of Russian-speaking bulletproof hosting provider Virtualine
ler a análise desta fonte ocultar
The US Justice Department and the FBI obtained a court order to seize the primary domain of Virtualine, a Russian-speaking bulletproof hosting provider used for sextortion, ransomware, data theft, malware hosting and money laundering. Officials said Virtualine kept hosting a customer distributing CSAM and a hack-for-hire service after repeated notices from law enforcement in Germany, Canada and Australia, the National Center for Missing and Exploited Children and a victim's attorney. TRM Labs says Virtualine was not the largest provider by total inflows but received the most illicit-attributed value of any tracked bulletproof host in 2026 to date, almost one-fifth of the total. TRM stresses the service was disrupted, not shut down, and the operators and underlying infrastructure may still be active.
Technical Details
- The seized domain was also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech.
- TRM attributes direct payments to Virtualine as follows: a Russian drug marketplace ~44%, a sextortion scheme ~17%, a cryptocurrency mixer ~13%, ransomware ~5%, cybercrime services 3% and malware 2%.
- Ransomware groups Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin paid the operators, as did customers tied to the StealC infostealer, the Matanbuchu loader, bot and malware-distribution services, and CSAM-linked sites.
Remediation
- A domain seizure disrupts how customers find and access the service but does not prove the operator has stopped or that customers lost access to the underlying infrastructure (TRM Labs).
- Defenders can use blockchain records of payments to Virtualine to trace customers and follow-on infrastructure, as TRM suggests.
-
FBI and European police seize Virtualine bulletproof hosting domain tied to ransomware, StealC and CSAM forum
ler a análise desta fonte ocultar
The FBI seized the primary domain of Virtualine, a bulletproof hosting service that also operated as Secury, Massgod, Spamhouse, Lanedo and Omegatech. The operation involved Polizei Hessen (Germany), Politie Midden-Nederland (Netherlands), the UK National Crime Agency, and private partners OverRIPE and Lumen. The service advertised support for phishing, spamming, carding and port scanning, and authorities allege it knowingly hosted a child abuse forum and ignored repeated abuse notices. Dutch police seized dozens of physical servers in Limburg, taking hundreds of virtual servers offline, and recovered data on more than 3,000 customers, against whom follow-up action is underway. The operator denies the child-abuse allegations in an open letter on a new site, virtualine[.]org, captured by Silent Push.
Technical Details
- Virtualine accepted direct Bitcoin payments through unhosted wallets, bypassing exchange compliance, and laundered the proceeds (Chainalysis).
- Chainalysis linked its payment addresses to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, scams and phishing platforms.
- TRM reports that ransomware groups made up about 5% of financial flows and a Russian drug marketplace about 44%. A large sextortion scheme and a mixer were also major sources. TRM also observed payments from the StealC infostealer this year, indicating a constant financial relationship.
- Dutch authorities say the platform facilitated ransomware, botnets, infostealers, phishing and child abuse material distribution since at least 2022.
- The provider is partially online, but its network prefixes show very low routing visibility, suggesting much of the infrastructure is unreachable.
Remediation
The article gives no specific defender guidance.
-
FBI seizes Virtualine bulletproof hosting domain over CSAM hosting and Bitcoin money laundering
ler a análise desta fonte ocultar
The U.S. Department of Justice announced the seizure of the virtualine[.]net domain, tied to the bulletproof hosting provider (BPH) Virtualine. The action was a coordinated operation with the Hessen State Police, the Dutch National Police Corps, the UK National Crime Agency, OverRIPE and Lumen Technologies. The DoJ says the service facilitated the advertisement of child sexual abuse material, nonconsensual intimate imagery and international money laundering. Virtualine, which also operated as Secury, Massgod, Spamhouse, Lanedo and Omegatech, marketed itself on cybercrime forums for phishing, carding, spam and port scanning. The operator has publicly denied knowingly hosting CSAM and says customer data is safe.
Technical Details
- Virtualine advertised on cybercrime forums, including HackForums (June 2025: "ignored more abuse than your last three therapists"). In March 2026 it launched an "additional protection plan" that would move customers' criminal infrastructure to an unaffiliated shell company when law enforcement requests arrived.
- Plans ranged from $19.99/month (1 vCPU, 2 GB RAM, 30 GB storage) to $179.99/month (24 vCPUs, 64 GB RAM), with optimized plans from $21.99 to $379.99/month.
- The DoJ says Virtualine hosted "Vendor 1", a criminal forum selling explicit images of minors and adults and promoting a hack-for-hire service. It kept hosting the forum after notices from law enforcement in Germany, Canada and Australia, NCMEC and a victim's attorney. It also allegedly helped build a new upload and purchase website that is still hosted by Virtualine.
- Virtualine accepted payments through unhosted Bitcoin addresses ("BTC [NO-AML]"). The DoJ says funds from criminal groups were received and then laundered.
- Chainalysis reports on-chain exposure to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops and scam/phishing addresses.
- Spamhaus reported in September 2025 that Virtualine had expanded to AS209800, routed via aurologic GmbH, and kept obtaining IPv4 prefixes from poorly vetted Turkey- and U.S.-based IP brokers. Silent Push notes that a lost ASN does not mean the BPH has stopped, because new ASNs are acquired quickly.
Remediation
- Treat infrastructure associated with Virtualine and its aliases, including AS209800, as high-risk when assessing network blocking and monitoring.
- ASN and IP-broker registration controls are suggested by Silent Push to be too lax and in need of tightening.